Which role lets AKS1's managed identity access Azure Cosmos DB?

SC-300 By islever Editorial Last updated

Short answer

B Assign the Azure Cosmos DB Account Reader Role to AKS1's managed identity on the DB1 Cosmos DB account scope, following least privilege.

Question

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains an Azure Cosmos DB database named DB1 and an Azure Kubernetes Service (AKS) cluster named AKS1. AKS1 uses a managed identity. You need to ensure that AKS1 can access DB1. The solution must meet the following requirements: • Ensure that AKS1 uses the managed identity to access DB1. • Follow the principle of least privilege. Which role should you assign to the managed identity of AKS1?
  1. For Sub1, assign the Owner role.
  2. For DB1, assign the Azure Cosmos DB Account Reader Role role. Correct Answer
  3. For RG1, assign the Azure Cosmos DB Data Reader Role role.
  4. For RG1, assign the Reader role.

Key Takeaways

It tests whether you can separate Cosmos DB control-plane roles (Azure RBAC, assignable from the account's IAM blade) from data-plane roles, with the trap being the option named 'Azure Cosmos DB Data Reader Role' that merely sounds more least-privilege.

AKS1 must reach Cosmos DB DB1 through its managed identity while staying least-privilege, so this SC-300 item tests which Azure RBAC role to grant. The verdict is the Cosmos DB Account Reader Role assigned on the DB1 account (B), not a subscription Owner or resource-group Reader role.

Common mistake: Choosing C, the Azure Cosmos DB Data Reader Role, because a 'data reader' sounds like the tightest possible permission; in reality it is a Cosmos DB data-plane role granted through Cosmos DB's own RBAC at account/database/container scope, not through an Azure IAM role assignment at the RG1 scope.

Expert Analysis

Why the Answer Is Correct

Option B assigns the Azure Cosmos DB Account Reader Role directly on DB1, the Cosmos DB account itself, which is exactly the boundary AKS1 needs to cross. This is an Azure RBAC control-plane role, so it can be granted to AKS1's managed identity from the Cosmos DB account's Access control (IAM) blade — the standard way to let a managed identity authenticate to the account, as Doinitza confirmed with a lab. Scoping the assignment to DB1 rather than Sub1 or RG1 satisfies the least-privilege requirement stated in the question. That combination of correct role type plus correct scope is what makes B the only fully compliant option.

Why the Other Options Are Wrong

Option A (Owner on Sub1) is enormously over-privileged and would let AKS1 manage every resource in the subscription, directly violating least privilege. Option D (Reader on RG1) is management-plane read access across all of RG1 and does not give the workload the Cosmos DB account-level access it requires. Option C names a role that does exist as a Cosmos DB data-plane role, but that role is assigned with Cosmos DB's native role-assignment mechanism scoped to an account, database or container — not by an Azure IAM role assignment at the RG1 scope that the option specifies. Even if the role name were acceptable, the scope in C makes it unassignable the way the option describes.

Community Comment Notes

Doinitza's lab walkthrough is the clearest evidence for B: creating a Cosmos DB account and assigning the Cosmos DB Account Reader Role to a managed identity from the account's IAM blade works. klayytech and blanco00555 describe the same step, and penatuna argued that options A and D "give too much privileges" while pointing out C is not an Azure RBAC role you can grant that way. Alcpt framed the real distinction: "RBAC in Azure Cosmos DB applies to either a data plane operations" or a management-plane operation, meaning the Account Reader Role is the management-plane grant a managed identity can actually receive via IAM. anonymousarpanch noted that both roles exist but that data-plane roles serve microservices and APIs, not this Azure RBAC assignment.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an option set mixes subscription, resource-group and resource scopes, eliminate on scope first: A (subscription) and D (resource group) cannot satisfy a least-privilege requirement aimed at one Cosmos DB account, so only B and C remain and the role-type distinction decides it.

Frequently Asked Questions

Why is the Azure Cosmos DB Data Reader Role option wrong?

It is a Cosmos DB data-plane role granted through Cosmos DB's own RBAC on an account, database or container, not an Azure IAM role assignment at the RG1 scope the option names.

Why not just assign Owner on Sub1 or Reader on RG1?

Both scopes are far broader than the AKS1 workload needs, violating least privilege, and neither targets the DB1 Cosmos DB account access AKS1 actually requires.

More SC-300 FAQ →

Community Votes

B
72%
C
28%

72% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. Doinitza 👍 8
    I think its B, in my lab, I have created an Azure Cosmos DB for NoSQL, then, in its "Access control (IAM)" blade, I can assign the role "Cosmos DB Account Reader Role" to a Managed Identity.
  2. klayytech 👍 3 Answered B
    In IAM of DB1: Assign the Managed Identity of AKS1 as CDB Account Reader Role
  3. RemmyT 👍 2 Answered B
    Built-in roles supported by Azure Cosmos DB DocumentDB Account Contributor - Can manage Azure Cosmos DB accounts Cosmos DB Account Reader Role - Can read Azure Cosmos DB account data CosmosBackupOperator - Can submit a restore request in the Azure portal for a periodic backup enabled database or a container. Can modify the backup interval and retention in the Azure portal. Cannot access any data or use Data Explorer CosmosRestoreOperator - Can perform a restore action for an Azure Cosmos DB account with continuous backup mode. Cosmos DB Operator - Can provision Azure Cosmos DB accounts, databases, and containers. Cannot access any data or use Data Explorer https://learn.microsoft.com/en-us/azure/cosmos-db/role-based-access-control
  4. Alcpt 👍 2
    Be careful! remember that RBAC in Azure Cosmos DB applies to either a data plane operations (database) or a management plane operations (outside of the database / account level only). The Data Reader Role is for those who need to work with the data stored in Cosmos DB (data plane), while the Account Reader Role is for those who need to manage the account itself without accessing the data within it. AKS1 needs to access DB1 data plane to read the data, else whats the point? I think the answer is Azure Cosmos DB Data Reader Role role = C
  5. penatuna 👍 2 Answered B
    It's got to be B. Answers A and D give too much privileges (A is for subscription scope and D is for Resource group scope). As for answer C, such role does not exist.
Show 7 more comments
  1. 02b144e 👍 2 Answered C
    The built-in role "Cosmos DB data reader" does exist https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/reference-data-plane-roles
  2. 02b144e 👍 2 Answered C
    The built-in role Cosmos DB reader does exist https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/reference-data-plane-roles
  3. JuanZ 👍 2 Answered B
    https://learn.microsoft.com/en-us/azure/cosmos-db/role-based-access-control
  4. anonymousarpanch 👍 1 Answered B
    Both Azure Cosmos DB Account Reader and Azure Cosmos DB Data Reader roles exist. The Account Reader role is for management plane settings (viewing configurations without data access), while the Data Reader role is for data plane access (reading stored data). Typically, security, IT, and compliance teams use the Account Reader role, while microservices, APIs, and developers use the Data Reader role. Since Azure Kubernetes Service (AKS) needs database access but not configuration settings, the least privilege approach applies, granting access only to DB1, not the entire RG1—making option 'B' correct.
  5. Oskarma 👍 1 Answered C
    The Azure Cosmos DB Account Reader Role allows read access to the account's metadata and configuration, not the data itself. Cannot Access Data: AKS1 would be able to read properties like account keys and settings but not the actual database content.
  6. Ody 👍 1
    If a Azure Cosmos DB Data Reader Role exists I can't find it. I think B has to be correct.
  7. Siraf 👍 1
    Correct Answer is B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide